MC1323250 - [Action Required] Update scripts using Get-MailDetailTransportRuleReport and Get-MailTrafficPolicyReport

What and Why:

To improve clarity, precision, and performance of transport rule reporting, Microsoft is updating the behavior of two Exchange Online reporting cmdlets. Starting July 30, 2026, Get-MailDetailTransportRuleReport and Get-MailTrafficPolicyReport will return transport rule data only when the request explicitly specifies the relevant EventType. This change helps ensure that reporting queries are intentional, predictable, and aligned with how transport rule events are generated and logged.

This update supports enterprise‑ready manageability by reducing ambiguous results and helping administrators build more reliable automation and compliance reporting.

Rollout Schedule:

General Availability (Worldwide): We will begin rolling out in late July 2026 and expect to complete by late July 2026.

Impact on Your Organization:

Who is affected:

• Exchange Online administrators
• Security, compliance, or messaging teams
• Any organization using PowerShell scripts, automation, or reporting that relies on transport rule data from these cmdlets

Platforms/Services:

• Exchange Online
• Exchange Online PowerShell

What will happen:

• Get-MailDetailTransportRuleReport and Get-MailTrafficPolicyReport will no longer return transport rule results by default.
• Transport rule data will be returned only when one of the following parameters is explicitly included:
  • -EventType TransportRuleHits
  • -EventType TransportRuleActionHits
• Scripts or reports that do not include one of these parameters may return empty or incomplete results.
• This change applies only to these two cmdlets. No other Exchange Online cmdlets are affected. 

Action Required / Recommendations:

If your organization uses these cmdlets for transport rule reporting, action is required before July 30, 2026.

Recommended actions:

• Review all scripts, scheduled jobs, and automation that use:
  • Get-MailDetailTransportRuleReport
    
  • Get-MailTrafficPolicyReport
    
• Update queries that require transport rule results to explicitly include:
  • -EventType TransportRuleHits or
    
  • -EventType TransportRuleActionHits
    
• Validate updated scripts in a non‑production or test context.
• Update internal documentation and operational runbooks.
  
• Notify messaging and security operations teams of this change.

Compliance considerations:

This change alters how admins retrieve and report on transport rule data for compliance and auditing purposes.

Please do not paste images here. Attach your high-resolution PNGs to the No Reply confirmation email. Thank you!

We're making some changes to <insert what we are changing>.

On/Starting <month, date 2025>, we're <insert what we are changing>.

How this will affect your organization:

You are receiving this message because our reporting indicates one or more users in your organization may be using this <insert feature/service/product version>.

<Note: admins often want to know which users are using the feature. Can we point them to a report to run?>

<Users or Administrators?> will <insert impact of configuration change>, when this change is implemented.

or

<Users or Administrators?> may no longer be able to <insert impact of feature change>, when this change is implemented.

What you need to do to prepare:

When this change takes effect, you will need to <insert any actions required. if none, state that>. 

<insert any workarounds, or alternatives>

Learn more: <article name and link; use link tool if possible>

Compliance considerations:

<<To assist our customers with identifying compliance concerns, review the questions below and provide details for impact if appropriate>>

• Does the change store new customer data?
• Does the change alter how existing customer data is processed, stored, or accessed (e.g. documents, emails, chats, etc.)?
• Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?
• Does the change provide a new way of communicating between users, tenants, or subscriptions?
• Does the change provide end users any new way of interacting with generative AI?
• Does the change modify, interrupt, or disable any of the following capabilities (Purview):
• Data Loss Prevention (DLP) policies or enforcement
• Information Protection labels or sensitive information types
• Conditional Access policies
• Audit logging capabilities
• eDiscovery or Content Search
• Encryption methods or key management
• Retention policies, holds, or deletion workflows?
• Does the change alter how admins can monitor, report on, or demonstrate compliance activities e.g. Purview or admin reporting?
• Does the change modify how users can access, export, delete, or correct their personal data within Microsoft 365 services (GDPR Data Subject Rights)?